Risk Assessment EDRP Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which of the following is typically included in risk assessment documentation?

   • AThe organization's annual budget for IT equipment.
   • BA list of identified threats and vulnerabilities with corresponding risk ratings.
   • CThe personal contact information of all employees.
   • DThe organization's marketing strategy.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A bank is evaluating risks to its mobile banking application. The risk assessment has identified a high likelihood of a phishing attack targeting customers. The bank's risk appetite is low, and the board has mandated that all high risks must be mitigated. The bank has a limited budget. Which of the following is the most appropriate risk treatment?

   • AIncrease customer awareness campaigns only
   • BAccept the risk because the budget is limited
   • CImplement multi-factor authentication for all customer accounts
   • DPurchase cyber insurance to cover potential losses
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A hospital's risk assessment identified a legacy medical device that cannot be patched and is connected to the network. The device is critical for patient monitoring. The risk owner proposes disconnecting the device from the network to eliminate the vulnerability. However, the device must transmit data to the electronic health record (EHR) system. What is the most appropriate risk treatment option?

   • AAccept the risk because the device is critical and cannot be replaced.
   • BImplement network segmentation and strict access controls to isolate the device while allowing necessary data flow.
   • CReplace the device immediately with a modern, patchable model.
   • DDisconnect the device from the network and manually record patient data.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A hospital has completed a risk assessment for its electronic health record (EHR) system. The findings indicate that a ransomware attack is a high-risk event. The hospital's DR plan currently focuses on data backup and recovery. What is the most important additional element to integrate into the DR plan based on the risk assessment?

   • AA communication plan for notifying patients and regulators
   • BA plan to increase the frequency of data backups
   • CA detailed incident response procedure for ransomware
   • DA policy to prohibit the use of personal devices
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A utility company is assessing risks to its SCADA systems. The team has identified a potential threat of a cyber attack. Which of the following is the most appropriate way to identify vulnerabilities related to this threat?

   • ADevelop a response plan for a cyber attack
   • BDetermine the likelihood of an attack occurring
   • CReview system configurations and patch levels
   • DEstimate the financial impact of a successful attack
   Reveal Solution Discussion Select an answer first